PT-2026-101740

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

Fedora 43 : nodejs-undici (2026-67f78e732b)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-67f78e732b advisory. Update to version 7.29.0. Contains fix for CVE-2026-18149. Tenable has extracted the preceding description block directly from the Fedora security advisory...

PT-2026-101325

Security vulnerability affects the nodejs package. This issue is resolved in later releases. See references for vulnerability details...

Malicious code in levels-node-config-nodejs-dione (npm)

Source: amazon-inspector 8d94739c23d7786f1a521acf68d3278bc133788d3b5c829c95dd3cdd53639ff1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in levels-event-bionics-nodejs (npm)

Source: amazon-inspector 3bdee777e410b3fc1869f19ba81326e968afb704dace7f49fb14bc7f0397e233 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in less-geckodriver-mongodb-nodejs (npm)

Source: amazon-inspector c73ceaac2d030bd57399d5bdb9ed7a5474907891e0deb0fd0a83c0ae1878ef20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in leda-nodejs-nextjs-sirius (npm)

Source: amazon-inspector 8488e7f3eb1b0a423523519eca85887ecd6c04e408dbec4c05e2e936659200fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in leda-async-nodejs-izar (npm)

Source: amazon-inspector 919099f39c4c627753c0eacb2c31a393a6a92e02b8a16c383406fc50a41281d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious Package

Overview leda-nodejs-nextjs-sirius is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in lbank-connector-nodejs (npm)

Source: amazon-inspector 269534d355daa221c39b34954aedea297175091aaf5ae63fec123b9bea17fa16 The package lbank-connector-nodejs was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in karma-gatsby-nodejs-europa (npm)

The package karma-gatsby-nodejs-europa was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in karma-centauri-nodejs-jupiter (npm)

Source: amazon-inspector fbea0749066ed1590c1aef758933c3c7852e36e96cd4693c167a1910e082d2c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jwt-jwt-nodejs-publish (npm)

Source: amazon-inspector ea2e66daf01fe913231340ad3a2cdd91b8d73f807dfad3ec9909c4c942dfcbff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Fedora 45 : nodejs-undici (2026-25a6102ac6)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-25a6102ac6 advisory. Update to version 7.29.0. Contains fix for CVE-2026-18149. Tenable has extracted the preceding description block directly from the Fedora security advisory...

Malicious code in process-mite (npm)

Source: amazon-inspector 4763fac30373bc805351d0eb8e0989cde9dcd2ab2c1b18f9eb7bde4e61765191 On import of the package main, index.js auto-invokes an initialize routine that spawns a detached node loader.js process. loader.js performs an HTTPS GET against the hardcoded endpoint...

CVE-2026-18149 affecting package nodejs for versions less than 24.21.0-1

CVE-2026-18149 affecting package nodejs for versions less than 24.21.0-1. An upgraded version of the package is available that resolves this issue...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the inflater process. An attacker can exhaust system memory and disrupt service availability ...

AZL-104937 CVE-2026-91728 affecting package nodejs 24.21.0-1

Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Malicious code in process-lhpm (npm)

Source: amazon-inspector a663308c4051eb4b31faf7fb984989f3e1b3498e505dc05052e2beb5fbf7e6d2 On require/import, index.js auto-invokes initialize, which spawns a detached, stdio-suppressed node loader.js background process. loader.js performs an HTTPS GET to https://api.npoint.io/33e8d008c334b060adad...

Astra Linux – Vulnerability in Node.js

The generateKeys API function returned by crypto.createDiffieHellman only generates missing or outdated keys. In other words, it only generates a private key if none has been set yet. However, this function is also needed to compute the corresponding public key after calling setPrivateKey...